fix: bump extras/dagger golang.org/x/net to v0.53.0

Closed
CH
3mo ago
+4-4

Summary

Updated the optional extras/dagger module to use the first golang.org/x/net release that fixes GO-2026-4918, and raised that module's Go directive so the patched dependency can resolve cleanly.

Vulnerability Fixed

GO-2026-4918-golang.org/x/net (HIGH): when processing HTTP/2 SETTINGS frames, the transport can loop indefinitely writing CONTINUATION frames after receiving SETTINGS_MAX_FRAME_SIZE=0, causing client-side denial of service.

Changes Made

  • Bumped golang.org/x/net in extras/dagger/go.mod from v0.44.0 to v0.53.0, the first fixed release for this advisory.
  • Raised the extras/dagger module go directive from 1.24.0 to 1.25.0 because golang.org/x/net v0.53.0 declares go 1.25.0.
  • Refreshed extras/dagger/go.sum with the v0.53.0 checksums.

Verification

Ran syft dir:. -o cyclonedx-json=/tmp/chainloop-sbom.json and grype sbom:/tmp/chainloop-sbom.json --only-fixed -o json against the patched repository. Classification: resolved. A targeted follow-up check confirmed GO-2026-4918-golang.org/x/net is no longer reported. Caveat: the scan still reports other unrelated fixed advisories in extras/dagger, including newer golang.org/x/net issues fixed after v0.53.0.

Risk Assessment

View the risk assessment in Chainloop